Automated Malware Analysis Report for Setup.Exe
Total Page：16
File Type：pdf, Size：1020Kb
ID: 156160 Sample Name: Setup.exe Cookbook: default.jbs Time: 04:51:37 Date: 25/07/2019 Version: 26.0.0 Aquamarine Table of Contents Table of Contents 2 Analysis Report Setup.exe 4 Overview 4 General Information 4 Detection 4 Confidence 5 Classification 5 Analysis Advice 5 Mitre Att&ck Matrix 6 Signature Overview 6 AV Detection: 6 Networking: 6 System Summary: 6 Data Obfuscation: 7 Persistence and Installation Behavior: 7 Hooking and other Techniques for Hiding and Protection: 7 Malware Analysis System Evasion: 7 Anti Debugging: 7 Language, Device and Operating System Detection: 7 Lowering of HIPS / PFW / Operating System Security Settings: 8 Behavior Graph 8 Simulations 8 Behavior and APIs 8 Antivirus and Machine Learning Detection 8 Initial Sample 8 Dropped Files 8 Unpacked PE Files 9 Domains 9 URLs 9 Yara Overview 9 Initial Sample 9 PCAP (Network Traffic) 9 Dropped Files 9 Memory Dumps 9 Unpacked PEs 9 Joe Sandbox View / Context 9 IPs 9 Domains 9 ASN 9 JA3 Fingerprints 9 Dropped Files 9 Screenshots 10 Thumbnails 10 Startup 10 Created / dropped Files 11 Domains and IPs 12 Contacted Domains 12 URLs from Memory and Binaries 12 Contacted IPs 12 Static File Info 12 General 12 File Icon 13 Static PE Info 13 General 13 Authenticode Signature 13 Entrypoint Preview 13 Rich Headers 15 Data Directories 15 Sections 15 Copyright Joe Security LLC 2019 Page 2 of 74 Resources 15 Imports 15 Version Infos 16 Possible Origin 16 Network Behavior 17 Code Manipulations 17 Statistics 17 Behavior 17 System Behavior 17 Analysis Process: Setup.exe PID: 2612 Parent PID: 4808 17 General 17 File Activities 17 File Read 17 Analysis Process: Setup.exe PID: 4520 Parent PID: 2612 18 General 18 File Activities 18 File Created 18 File Written 26 File Read 71 Registry Activities 72 Key Created 72 Key Value Created 72 Disassembly 74 Code Analysis 74 Copyright Joe Security LLC 2019 Page 3 of 74 Analysis Report Setup.exe Overview General Information Joe Sandbox Version: 26.0.0 Aquamarine Analysis ID: 156160 Start date: 25.07.2019 Start time: 04:51:37 Joe Sandbox Product: CloudBasic Overall analysis duration: 0h 4m 46s Hypervisor based Inspection enabled: false Report type: light Sample file name: Setup.exe Cookbook file name: default.jbs Analysis system description: Windows 10 64 bit (version 1803) with Office 2016, Adobe Reader DC 19, Chrome 70, Firefox 63, Java 8.171, Flash 30.0.0.113 Number of analysed new started processes analysed: 10 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies: HCA enabled EGA enabled HDC enabled AMSI enabled Analysis stop reason: Timeout Detection: SUS Classification: sus39.evad.winEXE@3/4@0/0 EGA Information: Failed HDC Information: Failed HCA Information: Failed Cookbook Comments: Adjust boot time Enable AMSI Found application associated with file extension: .exe Warnings: Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, sc.exe, dllhost.exe, WMIADAP.exe, conhost.exe, CompatTelRunner.exe Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtSetInformationFile calls found. Detection Strategy Score Range Reporting Whitelisted Detection Threshold 39 0 - 100 false Copyright Joe Security LLC 2019 Page 4 of 74 Confidence Strategy Score Range Further Analysis Required? Confidence Threshold 2 0 - 5 true Classification Ransomware Miner Spreading mmaallliiiccciiioouusss malicious Evader Phishing sssuusssppiiiccciiioouusss suspicious cccllleeaann clean Exploiter Banker Spyware Trojan / Bot Adware Analysis Advice Copyright Joe Security LLC 2019 Page 5 of 74 Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--") Sample monitors window changes (e.g. starting applications), analyze the sample with the 'Simulates keyboard and window changes' cookbook Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior Mitre Att&ck Matrix Privilege Defense Credential Lateral Command and Initial Access Execution Persistence Escalation Evasion Access Discovery Movement Collection Exfiltration Control Valid Accounts Windows Winlogon Port Monitors Software Credential Query Registry 1 Application Data from Local Data Data Remote Helper DLL Packing 1 Dumping Deployment System Compressed Obfuscation Management Software Replication Service Port Monitors Accessibility DLL Side- Network Process Remote Data from Exfiltration Over Fallback Through Execution Features Loading 1 Sniffing Discovery 1 Services Removable Other Network Channels Removable Media Medium Media Drive-by Windows Accessibility Path Rootkit Input Capture Application Windows Data from Automated Custom Compromise Management Features Interception Window Remote Network Exfiltration Cryptographic Instrumentation Discovery 1 Management Shared Drive Protocol Exploit Public- Scheduled Task System DLL Search Obfuscated Credentials Security Software Logon Scripts Input Capture Data Encrypted Multiband Facing Firmware Order Hijacking Files or in Files Discovery 1 2 1 Communication Application Information Spearphishing Command-Line Shortcut File System Masquerading Account System Shared Data Staged Scheduled Standard Link Interface Modification Permissions Manipulation Information Webroot Transfer Cryptographic Weakness Discovery 1 1 Protocol Signature Overview • AV Detection • Networking • System Summary • Data Obfuscation • Persistence and Installation Behavior • Hooking and other Techniques for Hiding and Protection • Malware Analysis System Evasion • Anti Debugging • Language, Device and Operating System Detection • Lowering of HIPS / PFW / Operating System Security Settings Click to jump to signature section AV Detection: Antivirus or Machine Learning detection for dropped file Antivirus or Machine Learning detection for unpacked file Networking: Found strings which match to known social media urls Urls found in memory or binary data System Summary: Creates mutexes PE file contains strange resources Copyright Joe Security LLC 2019 Page 6 of 74 Sample reads its own file content Tries to load missing DLLs Classification label Creates temporary files PE file has an executable .text section and no other executable section Parts of this applications are using the .NET runtime (Probably coded in C#) Reads software policies Sample might require command line arguments Spawns processes Uses an in-process (OLE) Automation server Found graphical window changes (likely an installer) Uses Microsoft Silverlight Checks if Microsoft Office is installed PE file has a valid certificate Submission file is bigger than most known malware samples PE file contains a mix of data directories often seen in goodware Contains modern PE file flags such as dynamic base (ASLR) or NX PE file contains a debug data directory Binary contains paths to debug symbols PE file contains a valid data directory to section mapping Data Obfuscation: PE file contains an invalid checksum PE file contains sections with non-standard names Persistence and Installation Behavior: Drops PE files Creates install or setup log file Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Malware Analysis System Evasion: Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) Contains long sleeps (>= 3 min) Found a high number of Window / User specific system calls (may be a loop to detect user behavior) May sleep (evasive loops) to hinder dynamic analysis Sample execution stops while process was sleeping (likely an evasion) May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory) Queries a list of all running processes Anti Debugging: Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation)) Enables debug privileges Language, Device and Operating System Detection: Queries the volume information (name, serial number etc) of a device Queries the cryptographic machine GUID Copyright Joe Security LLC 2019 Page 7 of 74 Lowering of HIPS / PFW / Operating System Security Settings: AV process strings found (often used to terminate AV products) Behavior Graph Hide Legend Behavior Graph Legend: ID: 156160 Process Sample: Setup.exe Signature Startdate: 25/07/2019 Created File Architecture: WINDOWS DNS/IP Info Score: 39 Is Dropped Is Windows Process Number of created Registry Values Tries to detect sandboxes Antivirus or Machine Number of created Files and other dynamic analysis Learning detection for started tools (process name dropped file Visual Basic or module or function) Delphi Java .Net C# or VB.NET Setup.exe C, C++ or other language Is malicious Internet started Setup.exe 38 138 dropped C:\Users\user\AppData\Local\...\mbahost.dll, PE32 Simulations Behavior and APIs Time Type Description 04:52:38 API Interceptor 3x Sleep call for process: Setup.exe modified Antivirus and Machine Learning Detection Initial Sample Source Detection Scanner Label Link Setup.exe 0% virustotal Browse Dropped Files Source Detection Scanner Label Link C:\Users\user\AppData\Local\Temp\{1d96cbc4-3dc0-45da-a711-29f5953d68e8}\.ba1\mbahost.dll 100% Avira WORM/Lodbak.Gen C:\Users\user\AppData\Local\Temp\{1d96cbc4-3dc0-45da-a711-29f5953d68e8}\.ba1\mbahost.dll